chore(release): 2.261.0 by aws-cdk-automation · Pull Request #38237 · aws/aws-cdk

aws-cdk-automation · 2026-07-02T10:15:44Z

Synthesized CloudFormation templates now include an `AWS::CDK::Source` entry in the top-level `Metadata` section containing the git remote repository URL and the latest commit hash. This helps trace deployed stacks back to their source code. Example output: ```yaml Metadata: AWS::CDK::Source: Repository: git@github.com:org/app.git Commit: 19e3e594a5512b75074526af89bf3b67a3164cc1 ``` The metadata is also added to the cloud assembly. This feature is disabled by default, and can be enabled by setting the context parameter `@aws-cdk/core:enableGitSource` to true. If the current directory is not a git repository or git is not available, the metadata entry is silently omitted. Also, for security, only use the repository URL and commit hash (obtained by running `git` commands) if they match the expected format. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.260.0/CHANGELOG.md)

…tes" (#38163) ### Reason for this change The two tests added in `core/test/stack.test.ts` assert a synthesized template contains `Metadata['AWS::CDK::Source']`. They pass inside a git checkout but fail when building from sources without a `.git` directory (e.g. a packaged artifact): `GitSource.of()` returns `undefined` (the feature's intended no-op), so the metadata is omitted and both assertions fail. This breaks the build in any non-git environment.

The types in `cloud-assembly-schema` are used in both the CLI and the core library now, as intended. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

For consistency, this prints any synth-time validation errors using the new formatter style, introduced in the CLI with `cdk validate`. It removes the old heavily tree-based style. Here's a decision tree of how the CDK app behaves now based on context keys: | failSynthOnValidationErrors | annotationsInValidationReport | action | |----|-----|-----| | true/unset | true | Prints all `Annotations.addWarning\|Error()` annotations. Exits if there are errors. | | true/unset | false | Prints only the result of policy validation plugins. Exits on errors. | | false | - | Nothing gets printed. | Also contains the following changes: - Error annotations converted to validation reports were considered suppressible (because they weren't `fatal`). These are now no longer considered suppressible. - Removed unnecessary "look at me" prints. - Refactored some code out to functions. - Refactored the tests by making fewer assertions and deduplicating repetitive code. - Missing construct paths are no longer renderd as `"N/A"`, but are an empty string instead. Changes to the report validation formatter w.r.t. the CLI (that will need to be backported): - Use grey to de-emphasize some details like plugin names - Use UPPERCASE severity markers - Render the template path if we can't render a construct path - Include the suggested fix if available - Render the rule name even if the violation is not suppressible. - For upconverted annotations, the `[ack]` tag was parsed in a weird place, and the error code wasn't parsed at all. - Render plugin failures. - Render filenames w.r.t the current working directory, so we don't unnecessarily render long absolute paths. New appearance <img width="1182" height="510" alt="image" src="https://github.com/user-attachments/assets/c75edd28-6253-4aae-a225-66ef5d9806cf" /> ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Reason for this change When building a `TarballImageAsset`, the tarball's relative path was interpolated directly into a shell command string that is executed via `sh -c`: ``` docker load -i <relativePathInOutDir> | tail -n 1 | sed "..." ``` Because the path was concatenated into the script verbatim, a path containing shell metacharacters (e.g. `$(...)`, `;`, backticks) would be interpreted by the shell rather than treated as literal data. ### Description of changes The tarball path is now passed as a positional argument (`$1`) to the shell script instead of being interpolated into it. The shell expands `"$1"` as literal data, so any metacharacters in the path are no longer evaluated: ``` sh -c 'docker load -i "$1" | tail -n 1 | sed "..."' cdk-tarball-image-asset <relativePathInOutDir> ``` `cdk-tarball-image-asset` is supplied as `$0` (the script name), and the path follows as `$1`. ### Describe any new or updated permissions being added None. ### Description of how you validated changes - Updated the existing unit tests in `tarball-asset.test.ts` to assert the new `executable` array shape. - Ran the PR through the CLI integ test pipeline to ensure nothing breaks in the happy path. A unit test is sufficient here because the fix lives entirely in what CDK synthesizes, not in what happens at deploy time. The fix changes how the tarball path is passed to the shell (positional $1 argument instead of string interpolation), and that decision is fully captured in the executable array of the asset manifest produced during app.synth(). An integ test that actually runs the resulting executable would merely test that the **shell** does what we think it does, not the CDK. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

) Fixes a typo in `docs/DESIGN_GUIDELINES.md` where the awslint rule `construct-inheritence` was misspelled and should be `construct-inheritance`. Closes #38119. --- _This contribution was AI-assisted (Claude). It's a small targeted fix — happy to revise, or just close if it's not a direction you want. No offense taken._

… and Instance (#35734) ### Issue # (if applicable) Closes #29239. ### Reason for this change Implements the `manageMasterUserPassword` property for RDS clusters and instances, enabling RDS native integration with AWS Secrets Manager for automatic master user password management. ### Description of changes Added `manageMasterUserPassword` property to `rds.Cluster` and `rds.Instance`. ### Describe any new or updated permissions being added N/A ### Description of how you validated changes Add unit tests and integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes various grammar errors and typos in source comments and JSDoc: - "can not" → "cannot" - "a the" → "the" - "allows to" → "allows you to" - "an warning" → "a warning", "an unique" → "a unique" - "that that" → "that" - "it's" → "its" (possessive) - Spelling: priveleges, acces, assoicated, exeuction, defualt - "eg." → "e.g." - Duplicate words removed Consolidates the following closed PRs into a single review: - #37400, #37420, #37422, #37423, #37426, #37427, #37428, #37429, #37440, #37441, #37442, #37443, #37444, #37445 All changes are documentation-only. No code behavior changes.

### Issue # (if applicable) Closes #38197. ### Reason for this change The `pr-triage-manager` job requested reviewers from team `aws-cdk-owners`, which does not exist in the `aws` org. Every PR from a beginning contributor failed with `Reviews may only be requested from collaborators`, leaving 25+ PRs with a failing check. ### Description of changes Updated `teamReviewers` in `.github/workflows/issue-label-assign.yml` from the non-existent `aws-cdk-owners` to the existing `aws-cdk-team`. ### Describe any new or updated permissions being added None. ### Description of how you validated changes CI-only change; verified `aws-cdk-owners` was the sole reference in `.github/` and corrected it to a valid team. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…cies (#38208) ### Issue # (if applicable) N/A ### Reason for this change Refreshes the aws-lambda-nodejs pnpm integration-test handler fixture to current dependency versions. ### Description of changes Bumped axios to ^1.16.0 (resolves to 1.18.1) and regenerated pnpm-lock.yaml; transitive form-data updates to 4.0.6 as a result. Scope is limited to the pnpm integ-handler test fixture. ### Describe any new or updated permissions being added None. ### Description of how you validated changes pnpm install --lockfile-only and pnpm install --frozen-lockfile both succeed; the lockfile resolves consistently with no other intended changes. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…38209) ### Issue # (if applicable) N/A ### Reason for this change The `aws-lambda-python-alpha` integration-test fixtures still pinned the deprecated Python 3.9 runtime. This drops Python 3.9 and refreshes the fixtures to the current supported range. ### Description of changes Removed the Python 3.9 cases from the poetry and uv integ tests (the matrix already covers 3.10–3.13), raised the fixture Python floor to `>=3.10`, and regenerated `poetry.lock`/`uv.lock` — which updates urllib3 to 2.7.0, version upgrade. The affected integration-test snapshots were regenerated to match. ### Describe any new or updated permissions being added None. These changes are limited to integration-test fixtures and snapshots. ### Description of how you validated changes `poetry check --lock` and `uv lock --check` pass; snapshots regenerated with the integ-runner. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Reason for this change Previously when working with sym links, we would consider sibling paths with the same prefix as being internal. EX: ``` ./hello/world/file.txt ./hello/world-something/new-dir/other-file.txt <-- this would be considered to be an internal path of ./hello/world/ ``` ### Description of changes Consolidated logic to tell whether we are looking at an internal path in one place. Improved internal path detection logic so sibling paths with the same prefix are no longer considered internal. ### Describe any new or updated permissions being added N/A ### Description of how you validated changes Added new unit tests ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> <h2>v5.0.5</h2> <h2>What's Changed</h2> <ul> <li>Update ts-http-runtime dependency by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p> <h2>v5.0.4</h2> <h2>What's Changed</h2> <ul> <li>Add release instructions and update maintainer docs by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li> <li>Potential fix for code scanning alert no. 52: Workflow does not contain permissions by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li> <li>Fix workflow permissions and cleanup workflow names / formatting by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li> <li>docs: Update examples to use the latest version by <a href="https://github.com/XZTDean"><code>@XZTDean</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li>Fix proxy integration tests by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li> <li>Fix cache key in examples.md for bun.lock by <a href="https://github.com/RyPeck"><code>@RyPeck</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> <li>Update dependencies & patch security vulnerabilities by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XZTDean"><code>@XZTDean</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li><a href="https://github.com/RyPeck"><code>@RyPeck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p> <h2>v.5.0.2</h2> <h1>v5.0.2</h1> <h2>What's Changed</h2> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v5...v6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

### Description of changes Automatically generate metrics facades. Usage: ```typescript // L1 / L2 Lambda const fn: lambda.Function // Scoped metrics from L2 const fnMetrics = LambdaMetrics.fromFunction(fn); // Create metric const metric = fnMetrics.metricErrors(); // Use metric as usual new cloudwatch.Alarm(this, 'L2ErrorAlarm', { metric: metric alarmName: 'MixinsPreview-L2-Errors', threshold: 5, evaluationPeriods: 1, comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD, }); ``` Generated code structure: ```typescript // Generated structure (abbreviated) export class LambdaMetrics { // Factory: create metrics from a Function reference (auto-fills dimensions) static fromFunction(ref: IFunctionRef): LambdaMetrics.FunctionMetrics; } export namespace LambdaMetrics { // Per-function metrics (dimension: FunctionName) interface FunctionMetricsProps { readonly functionName: string; } class FunctionMetrics { constructor(props: FunctionMetricsProps); metricInvocations(options?: MetricOptions): IMetric; metricErrors(options?: MetricOptions): IMetric; metricDuration(options?: MetricOptions): IMetric; metricThrottles(options?: MetricOptions): IMetric; // ... more metric methods } // Per-function + resource metrics (dimensions: FunctionName, Resource) interface ResourceMetricsProps { readonly functionName: string; readonly resource: string; } class ResourceMetrics { constructor(props: ResourceMetricsProps); metricInvocations(options?: MetricOptions): IMetric; // ... + metricProvisionedConcurrencyUtilization } // Per-version metrics (dimensions: ExecutedVersion, FunctionName, Resource) interface ExecutedVersionMetricsProps { readonly executedVersion: string; readonly functionName: string; readonly resource: string; } class ExecutedVersionMetrics { /* ... */ } // Account-level metrics (no dimensions) class AccountMetrics { constructor(); metricInvocations(options?: MetricOptions): IMetric; metricUnreservedConcurrentExecutions(options?: MetricOptions): IMetric; // ... } } ``` ### Description of how you validated changes Added unit and integration test ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) Closes #37854. ### Reason for this change The `g7e` instance family (NVIDIA Blackwell B200, 96 GB VRAM per GPU) is not included in the `InstanceClass` enum in `aws-ec2` or in the `isGpuInstanceType` allowlist in `aws-eks`. This causes `addNodegroupCapacity` / `add_nodegroup_capacity` to fail with an AMI-type validation error when a `g7e` instance is specified with `AL2023_X86_64_NVIDIA`. ### Description of changes **`packages/aws-cdk-lib/aws-ec2/lib/instance-types.ts`** - Added `GRAPHICS7_EFFICIENT = 'graphics7-efficient'` and `G7E = 'g7e'` to the `InstanceClass` enum, following the same pattern as `GRAPHICS6_EFFICIENT` / `G6E`. - Added the corresponding entries to the reverse lookup map inside `InstanceType.of`. **`packages/aws-cdk-lib/aws-eks/lib/private/nodegroup.ts`** - Added `InstanceClass.G7E` to the `knownGpuInstanceTypes` array in `isGpuInstanceType`, so that `g7e` instances are recognised as GPU and the correct NVIDIA AMI type is selected automatically. ### Description of how you validated changes - Added `ec2.InstanceType.of(ec2.InstanceClass.G7E, ec2.InstanceSize.XLARGE2)` to the existing `isGpuInstanceType` positive-case test. - Added a new nodegroup test (`amiType should be AL2_x86_64_GPU with g7e instanceType`) mirroring the existing `g6e` test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action

---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec` **L1 CloudFormation resource definition changes:** ``` ├[~] service aws-amazonmq │ └ resources │ └[~] resource AWS::AmazonMQ::Broker │ └ properties │ └[+] ResourceShareArns: Array<string> ├[~] service aws-apigatewayv2 │ └ resources │ └[~] resource AWS::ApiGatewayV2::Integration │ └ - arnTemplate: arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/integrations │ + arnTemplate: undefined ├[~] service aws-arcregionswitch │ └ resources │ └[~] resource AWS::ARCRegionSwitch::Plan │ └ - arnTemplate: arn:${Partition}:arc-region-switch::${Account}:plan/${ResourceId} │ + arnTemplate: arn:${Partition}:arc-region-switch:${Region}:${Account}:plan/${ResourceId} ├[~] service aws-bedrock │ └ resources │ ├[~] resource AWS::Bedrock::DataSource │ │ ├ attributes │ │ │ └ DataSourceStatus: - string<AVAILABLE|DELETING|DELETE_UNSUCCESSFUL> │ │ │ + string<AVAILABLE|DELETING|DELETE_UNSUCCESSFUL|CREATING|UPDATING|FAILED> │ │ └ types │ │ ├[+] type AudioExtractionConfiguration │ │ │ ├ documentation: Configuration for audio extraction. │ │ │ │ name: AudioExtractionConfiguration │ │ │ └ properties │ │ │ └ AudioExtractionStatus: string<ENABLED|DISABLED> (required) │ │ ├[~] type DataSourceConfiguration │ │ │ └ properties │ │ │ ├[+] ManagedKnowledgeBaseConnectorConfiguration: ManagedKnowledgeBaseConnectorConfiguration │ │ │ └ Type: - string<S3|CONFLUENCE|SALESFORCE|SHAREPOINT|WEB|CUSTOM|REDSHIFT_METADATA> (required, immutable) │ │ │ + string<S3|CONFLUENCE|SALESFORCE|SHAREPOINT|WEB|CUSTOM|REDSHIFT_METADATA|MANAGED_KNOWLEDGE_BASE_CONNECTOR> (required, immutable) │ │ ├[+] type DeletionProtectionConfiguration │ │ │ ├ documentation: Configuration for deletion protection. │ │ │ │ name: DeletionProtectionConfiguration │ │ │ └ properties │ │ │ ├ DeletionProtectionStatus: string<ENABLED|DISABLED> (required) │ │ │ └ DeletionProtectionThreshold: integer (default=15) │ │ ├[+] type ImageExtractionConfiguration │ │ │ ├ documentation: Configuration for image extraction. │ │ │ │ name: ImageExtractionConfiguration │ │ │ └ properties │ │ │ └ ImageExtractionStatus: string<ENABLED|DISABLED> (required) │ │ ├[+] type ManagedKnowledgeBaseConnectorConfiguration │ │ │ ├ documentation: Configuration for managed knowledge base connector data sources. │ │ │ │ name: ManagedKnowledgeBaseConnectorConfiguration │ │ │ └ properties │ │ │ ├ DeletionProtectionConfiguration: DeletionProtectionConfiguration │ │ │ ├ MediaExtractionConfiguration: MediaExtractionConfiguration │ │ │ └ ConnectorParameters: json │ │ ├[+] type MediaExtractionConfiguration │ │ │ ├ documentation: Configuration for media extraction settings. │ │ │ │ name: MediaExtractionConfiguration │ │ │ └ properties │ │ │ ├ ImageExtractionConfiguration: ImageExtractionConfiguration │ │ │ ├ AudioExtractionConfiguration: AudioExtractionConfiguration │ │ │ └ VideoExtractionConfiguration: VideoExtractionConfiguration │ │ ├[~] type ParsingConfiguration │ │ │ └ properties │ │ │ └ ParsingStrategy: - string<BEDROCK_FOUNDATION_MODEL|BEDROCK_DATA_AUTOMATION> (required) │ │ │ + string<BEDROCK_FOUNDATION_MODEL|BEDROCK_DATA_AUTOMATION|SMART_PARSING> (required) │ │ └[+] type VideoExtractionConfiguration │ │ ├ documentation: Configuration for video extraction. │ │ │ name: VideoExtractionConfiguration │ │ └ properties │ │ └ VideoExtractionStatus: string<ENABLED|DISABLED> (required) │ └[~] resource AWS::Bedrock::KnowledgeBase │ ├ attributes │ │ └ Status: - string<CREATING|ACTIVE|DELETING|UPDATING|FAILED|DELETE_UNSUCCESSFUL> │ │ + string<CREATING|ACTIVE|DELETING|UPDATING|FAILED|DELETE_UNSUCCESSFUL|UPDATE_UNSUCCESSFUL> │ └ types │ ├[~] type KnowledgeBaseConfiguration │ │ └ properties │ │ ├[+] ManagedKnowledgeBaseConfiguration: ManagedKnowledgeBaseConfiguration (immutable) │ │ └ Type: - string<VECTOR|KENDRA|SQL> (required, immutable) │ │ + string<VECTOR|KENDRA|SQL|MANAGED> (required, immutable) │ ├[+] type ManagedKnowledgeBaseConfiguration │ │ ├ documentation: Contains details about the model used to create vector embeddings for a managed knowledge base. │ │ │ name: ManagedKnowledgeBaseConfiguration │ │ └ properties │ │ ├ EmbeddingModelArn: string (required) │ │ ├ EmbeddingModelType: string<CUSTOM|MANAGED> │ │ ├ EmbeddingModelConfiguration: EmbeddingModelConfiguration │ │ └ ServerSideEncryptionConfiguration: ManagedKnowledgeBaseServerSideEncryptionConfiguration │ └[+] type ManagedKnowledgeBaseServerSideEncryptionConfiguration │ ├ documentation: Contains details about the server-side encryption for the managed knowledge base. │ │ name: ManagedKnowledgeBaseServerSideEncryptionConfiguration │ └ properties │ └ KmsKeyArn: string ├[~] service aws-bedrockagentcore │ └ resources │ ├[~] resource AWS::BedrockAgentCore::ConfigurationBundle │ │ └ properties │ │ └[+] KmsKeyArn: string │ ├[~] resource AWS::BedrockAgentCore::GatewayTarget │ │ ├ properties │ │ │ └ Name: - string (required) │ │ │ + string │ │ └ types │ │ ├[+] type ConnectorConfiguration │ │ │ ├ name: ConnectorConfiguration │ │ │ └ properties │ │ │ ├ Name: string (required) │ │ │ ├ Description: string │ │ │ ├ ParameterValues: json │ │ │ └ ParameterOverrides: Array<ConnectorParameterOverride> │ │ ├[+] type ConnectorParameterOverride │ │ │ ├ name: ConnectorParameterOverride │ │ │ └ properties │ │ │ ├ Path: string (required) │ │ │ ├ Description: string │ │ │ └ Visible: boolean │ │ ├[+] type ConnectorSource │ │ │ ├ name: ConnectorSource │ │ │ └ properties │ │ │ └ ConnectorId: string (required) │ │ ├[+] type ConnectorTargetConfiguration │ │ │ ├ name: ConnectorTargetConfiguration │ │ │ └ properties │ │ │ ├ Source: ConnectorSource (required) │ │ │ ├ Enabled: Array<string> │ │ │ └ Configurations: Array<ConnectorConfiguration> │ │ ├[+] type HttpApiSchemaConfiguration │ │ │ ├ name: HttpApiSchemaConfiguration │ │ │ └ properties │ │ │ └ Source: ApiSchemaConfiguration (required) │ │ ├[~] type HttpTargetConfiguration │ │ │ └ properties │ │ │ ├ AgentcoreRuntime: - RuntimeTargetConfiguration (required) │ │ │ │ + RuntimeTargetConfiguration │ │ │ └[+] Passthrough: PassthroughTargetConfiguration │ │ ├[~] type McpTargetConfiguration │ │ │ └ properties │ │ │ └[+] Connector: ConnectorTargetConfiguration │ │ ├[+] type PassthroughTargetConfiguration │ │ │ ├ name: PassthroughTargetConfiguration │ │ │ └ properties │ │ │ ├ Endpoint: string (required) │ │ │ ├ ProtocolType: string<MCP|A2A|INFERENCE|CUSTOM> (required) │ │ │ ├ Schema: HttpApiSchemaConfiguration │ │ │ └ StickinessConfiguration: StickinessConfiguration │ │ ├[~] type RuntimeTargetConfiguration │ │ │ └ properties │ │ │ └[+] Schema: HttpApiSchemaConfiguration │ │ └[+] type StickinessConfiguration │ │ ├ name: StickinessConfiguration │ │ └ properties │ │ ├ Identifier: string (required) │ │ └ Timeout: integer │ ├[~] resource AWS::BedrockAgentCore::Harness │ │ ├ - documentation: Definition of AWS::BedrockAgentCore::Harness resource type - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents. │ │ │ + documentation: Resource Type definition for AWS::BedrockAgentCore::Harness - a managed agentic loop service that provides a turnkey solution for running stateful, tool-equipped AI agents. │ │ ├ attributes │ │ │ ├[+] Memory.ManagedMemoryConfiguration.Arn: string │ │ │ └[+] Version: string │ │ └ types │ │ ├[~] type CustomJWTAuthorizerConfiguration │ │ │ └ properties │ │ │ ├[+] PrivateEndpoint: PrivateEndpoint │ │ │ └[+] PrivateEndpointOverrides: Array<PrivateEndpointOverride> │ │ ├[+] type EfsAccessPointConfiguration │ │ │ ├ documentation: Configuration for an Amazon EFS access point to mount into the AgentCore Runtime. │ │ │ │ name: EfsAccessPointConfiguration │ │ │ └ properties │ │ │ ├ AccessPointArn: string (required) │ │ │ └ MountPath: string (required) │ │ ├[~] type FilesystemConfiguration │ │ │ └ properties │ │ │ ├[+] EfsAccessPoint: EfsAccessPointConfiguration │ │ │ ├[+] S3FilesAccessPoint: S3FilesAccessPointConfiguration │ │ │ └ SessionStorage: - SessionStorageConfiguration (required) │ │ │ + SessionStorageConfiguration │ │ ├[~] type HarnessAgentCoreMemoryRetrievalConfig │ │ │ └ properties │ │ │ ├ RelevanceScore: - number │ │ │ │ + number | string │ │ │ └ TopK: - integer │ │ │ + integer | string │ │ ├[~] type HarnessAgentCoreRuntimeEnvironment │ │ │ └ properties │ │ │ └ NetworkConfiguration: - NetworkConfiguration (immutable) │ │ │ + NetworkConfiguration │ │ ├[~] type HarnessBedrockModelConfig │ │ │ └ properties │ │ │ └[+] ApiFormat: string<converse_stream|responses|chat_completions> │ │ ├[+] type HarnessLiteLlmModelConfig │ │ │ ├ name: HarnessLiteLlmModelConfig │ │ │ └ properties │ │ │ ├ ModelId: string (required) │ │ │ ├ ApiKeyArn: string │ │ │ ├ ApiBase: string │ │ │ ├ MaxTokens: integer │ │ │ ├ Temperature: number │ │ │ └ TopP: number │ │ ├[+] type HarnessManagedMemoryConfiguration │ │ │ ├ documentation: Configuration for managed memory. The harness creates and manages a memory resource in the customer's account. │ │ │ │ name: HarnessManagedMemoryConfiguration │ │ │ └ properties │ │ │ ├ Arn: string │ │ │ ├ Strategies: Array<string<SEMANTIC|SUMMARIZATION|USER_PREFERENCE|EPISODIC>> │ │ │ ├ EventExpiryDuration: integer │ │ │ └ EncryptionKeyArn: string (immutable) │ │ ├[~] type HarnessMemoryConfiguration │ │ │ └ properties │ │ │ ├[+] Disabled: json │ │ │ └[+] ManagedMemoryConfiguration: HarnessManagedMemoryConfiguration │ │ ├[~] type HarnessModelConfiguration │ │ │ └ properties │ │ │ └[+] LiteLlmModelConfig: HarnessLiteLlmModelConfig │ │ ├[~] type HarnessOpenAiModelConfig │ │ │ └ properties │ │ │ └[+] ApiFormat: string<chat_completions|responses> │ │ ├[~] type HarnessSkill │ │ │ └ properties │ │ │ ├[+] AwsSkills: HarnessSkillAwsSkillsSource │ │ │ ├[+] Git: HarnessSkillGitSource │ │ │ ├ Path: - string (required) │ │ │ │ + string │ │ │ └[+] S3: HarnessSkillS3Source │ │ ├[+] type HarnessSkillAwsSkillsSource │ │ │ ├ documentation: AWS Skills baked into the Harness's underlying Runtime. │ │ │ │ name: HarnessSkillAwsSkillsSource │ │ │ └ properties │ │ │ └ Paths: Array<string> │ │ ├[+] type HarnessSkillGitAuth │ │ │ ├ documentation: Authentication configuration for accessing a private git repository. │ │ │ │ name: HarnessSkillGitAuth │ │ │ └ properties │ │ │ ├ CredentialArn: string (required) │ │ │ └ Username: string │ │ ├[+] type HarnessSkillGitSource │ │ │ ├ documentation: A git repository containing the skill, cloned over HTTPS. │ │ │ │ name: HarnessSkillGitSource │ │ │ └ properties │ │ │ ├ Url: string (required) │ │ │ ├ Path: string │ │ │ └ Auth: HarnessSkillGitAuth │ │ ├[+] type HarnessSkillS3Source │ │ │ ├ documentation: An S3 source containing the skill. │ │ │ │ name: HarnessSkillS3Source │ │ │ └ properties │ │ │ └ Uri: string (required) │ │ ├[+] type ManagedVpcResource │ │ │ ├ documentation: Configuration for a service-managed VPC endpoint. │ │ │ │ name: ManagedVpcResource │ │ │ └ properties │ │ │ ├ VpcIdentifier: string (required) │ │ │ ├ SubnetIds: Array<string> (required) │ │ │ ├ EndpointIpAddressType: string<IPV4|IPV6> (required) │ │ │ ├ SecurityGroupIds: Array<string> │ │ │ ├ Tags: Map<string, string> │ │ │ └ RoutingDomain: string │ │ ├[+] type PrivateEndpoint │ │ │ ├ documentation: Private endpoint configuration for connecting to the OpenID Connect discovery endpoint over a private network. │ │ │ │ name: PrivateEndpoint │ │ │ └ properties │ │ │ ├ SelfManagedLatticeResource: SelfManagedLatticeResource │ │ │ └ ManagedVpcResource: ManagedVpcResource │ │ ├[+] type PrivateEndpointOverride │ │ │ ├ documentation: Maps a domain to a private endpoint for resolving that domain over a private network. │ │ │ │ name: PrivateEndpointOverride │ │ │ └ properties │ │ │ ├ Domain: string (required) │ │ │ └ PrivateEndpoint: PrivateEndpoint (required) │ │ ├[+] type S3FilesAccessPointConfiguration │ │ │ ├ documentation: Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime. │ │ │ │ name: S3FilesAccessPointConfiguration │ │ │ └ properties │ │ │ ├ AccessPointArn: string (required) │ │ │ └ MountPath: string (required) │ │ └[+] type SelfManagedLatticeResource │ │ ├ documentation: Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration. │ │ │ name: SelfManagedLatticeResource │ │ └ properties │ │ └ ResourceConfigurationIdentifier: string (required) │ └[~] resource AWS::BedrockAgentCore::Policy │ ├ properties │ │ └[+] EnforcementMode: string<ACTIVE|LOG_ONLY> (default="ACTIVE") │ └ types │ ├[~] type PolicyDefinition │ │ └ properties │ │ ├ Cedar: - CedarPolicy (required) │ │ │ + CedarPolicy │ │ └[+] Policy: PolicyStatement │ └[+] type PolicyStatement │ ├ documentation: A policy statement within the AgentCore Policy system. │ │ name: PolicyStatement │ └ properties │ └ Statement: string (required) ├[~] service aws-chatbot │ └ resources │ └[~] resource AWS::Chatbot::SlackChannelConfiguration │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:chatbot::${Account}:chat-configuration/slack-channel/${ConfigurationName} ├[~] service aws-cloudwatch │ └ resources │ └[~] resource AWS::CloudWatch::LogAlarm │ └ types │ └[~] type ScheduledQueryConfiguration │ └ properties │ └[-] QueryLanguage: string (required) ├[~] service aws-codepipeline │ └ resources │ └[~] resource AWS::CodePipeline::Webhook │ ├ - tagInformation: undefined │ │ + tagInformation: {"tagPropertyName":"Tags","variant":"standard"} │ └ properties │ └[+] Tags: Array<tag> ├[~] service aws-cognito │ └ resources │ └[~] resource AWS::Cognito::UserPoolDomain │ ├ properties │ │ └[+] Routing: RoutingType │ └ types │ ├[+] type FailoverType │ │ ├ name: FailoverType │ │ └ properties │ │ ├ SecondaryRegion: string (required) │ │ └ PrimaryRoute53HealthCheckId: string (required) │ └[+] type RoutingType │ ├ name: RoutingType │ └ properties │ └ Failover: FailoverType ├[~] service aws-datapipeline │ └ resources │ └[~] resource AWS::DataPipeline::Pipeline │ └ - arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineId} │ + arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineID} ├[~] service aws-directoryservice │ └ resources │ └[~] resource AWS::DirectoryService::MicrosoftAD │ └ - arnTemplate: arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId} │ + arnTemplate: arn:${Partition}:ds:${Region}:${Account}:${DirectoryId} ├[~] service aws-ecs │ └ resources │ └[~] resource AWS::ECS::Service │ ├ properties │ │ └[+] Monitoring: MonitoringConfiguration │ └ types │ ├[+] type MetricConfiguration │ │ ├ name: MetricConfiguration │ │ └ properties │ │ ├ ResolutionSeconds: integer<20|60> (required) │ │ └ MetricNames: Array<string<CPUUtilization|MemoryUtilization>> (required) │ └[+] type MonitoringConfiguration │ ├ name: MonitoringConfiguration │ └ properties │ └ MetricConfigurations: Array<MetricConfiguration> (required) ├[~] service aws-eks │ └ resources │ └[~] resource AWS::EKS::Cluster │ └ types │ └[~] type ResourcesVpcConfig │ └ properties │ └[+] ControlPlaneEgressMode: string ├[~] service aws-elasticloadbalancing │ └ resources │ └[~] resource AWS::ElasticLoadBalancing::LoadBalancer │ ├ - primaryIdentifier: ["Id"] │ │ + primaryIdentifier: ["LoadBalancerName"] │ └ attributes │ └[-] Id: string ├[~] service aws-gamelift │ └ resources │ └[~] resource AWS::GameLift::ContainerGroupDefinition │ └ types │ ├[~] type GameServerContainerDefinition │ │ └ properties │ │ └[+] LinuxCapabilities: LinuxCapabilities │ ├[+] type LinuxCapabilities │ │ ├ documentation: A set of Linux capabilities that are added to a container's default Docker configuration. For more detailed information, see the capabilities(7) Linux manual page. │ │ │ name: LinuxCapabilities │ │ └ properties │ │ └ Include: Array<string<AUDIT_CONTROL|AUDIT_WRITE|BLOCK_SUSPEND|CHOWN|DAC_OVERRIDE|DAC_READ_SEARCH|FOWNER|FSETID|IPC_LOCK|IPC_OWNER|KILL|LEASE|LINUX_IMMUTABLE|MAC_ADMIN|MAC_OVERRIDE|MKNOD|NET_ADMIN|NET_BIND_SERVICE|NET_BROADCAST|NET_RAW|SETFCAP|SETGID|SETPCAP|SETUID|SYS_ADMIN|SYS_BOOT|SYS_CHROOT|SYS_MODULE|SYS_NICE|SYS_PACCT|SYS_PTRACE|SYS_RAWIO|SYS_RESOURCE|SYS_TIME|SYS_TTY_CONFIG|SYSLOG|WAKE_ALARM>> │ └[~] type SupportContainerDefinition │ └ properties │ └[+] LinuxCapabilities: LinuxCapabilities ├[~] service aws-iotwireless │ └ resources │ └[~] resource AWS::IoTWireless::WirelessDeviceImportTask │ └ - arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:ImportTask/${ImportTaskId} │ + arnTemplate: arn:${Partition}:iotwireless:${Region}:${Account}:WirelessDeviceImportTask/${WirelessDeviceImportTaskId} ├[~] service aws-lambda │ └ resources │ ├[~] resource AWS::Lambda::CapacityProvider │ │ └ types │ │ └[~] type PropagateTagsConfig │ │ └ - documentation: undefined │ │ + documentation: Configuration that defines how tags are propagated to managed resources. │ ├[~] resource AWS::Lambda::LayerVersion │ │ └ types │ │ └[~] type Content │ │ └ properties │ │ └[+] S3ObjectStorageMode: string<COPY|REFERENCE> │ ├[+] resource AWS::Lambda::MicrovmImage │ │ ├ name: MicrovmImage │ │ │ cloudFormationType: AWS::Lambda::MicrovmImage │ │ │ documentation: Resource Type definition for AWS::Lambda::MicrovmImage │ │ │ tagInformation: {"tagPropertyName":"Tags","variant":"standard"} │ │ │ arnTemplate: arn:${Partition}:lambda:${Region}:${Account}:microvm-image:${MicrovmImageName} │ │ │ primaryIdentifier: ["ImageArn"] │ │ ├ properties │ │ │ ├ Name: string (required, immutable) │ │ │ ├ BaseImageArn: string (required) │ │ │ ├ BaseImageVersion: string (required) │ │ │ ├ BuildRoleArn: string (required) │ │ │ ├ Description: string (required) │ │ │ ├ CodeArtifact: CodeArtifact (required) │ │ │ ├ Logging: Logging (required) │ │ │ ├ EgressNetworkConnectors: Array<string> (required) │ │ │ ├ CpuConfigurations: Array<CpuConfiguration> (required) │ │ │ ├ Resources: Array<Resources> (required) │ │ │ ├ AdditionalOsCapabilities: Array<string<ALL>> (required) │ │ │ ├ Hooks: Hooks (required) │ │ │ ├ EnvironmentVariables: Array<EnvironmentVariable> (required) │ │ │ └ Tags: Array<tag> │ │ ├ attributes │ │ │ ├ ImageArn: string │ │ │ ├ State: string<CREATING|CREATED|CREATE_FAILED|UPDATING|UPDATED|UPDATE_FAILED|DELETING|DELETE_FAILED|DELETED> │ │ │ ├ LatestActiveImageVersion: string │ │ │ ├ LatestFailedImageVersion: string │ │ │ ├ CreatedAt: string │ │ │ └ UpdatedAt: string │ │ └ types │ │ ├ type CloudWatchLogging │ │ │ ├ name: CloudWatchLogging │ │ │ └ properties │ │ │ ├ LogGroup: string │ │ │ └ LogStream: string │ │ ├ type CodeArtifact │ │ │ ├ name: CodeArtifact │ │ │ └ properties │ │ │ └ Uri: string (required) │ │ ├ type CpuConfiguration │ │ │ ├ name: CpuConfiguration │ │ │ └ properties │ │ │ └ Architecture: string<ARM_64> (required) │ │ ├ type EnvironmentVariable │ │ │ ├ name: EnvironmentVariable │ │ │ └ properties │ │ │ ├ Key: string (required) │ │ │ └ Value: string (required) │ │ ├ type Hooks │ │ │ ├ name: Hooks │ │ │ └ properties │ │ │ ├ Port: integer │ │ │ ├ MicrovmHooks: MicrovmHooks │ │ │ └ MicrovmImageHooks: MicrovmImageHooks │ │ ├ type Logging │ │ │ ├ name: Logging │ │ │ └ properties │ │ │ ├ Disabled: boolean (default=false) │ │ │ └ CloudWatch: CloudWatchLogging │ │ ├ type MicrovmHooks │ │ │ ├ name: MicrovmHooks │ │ │ └ properties │ │ │ ├ Run: string<DISABLED|ENABLED> │ │ │ ├ RunTimeoutInSeconds: integer │ │ │ ├ Resume: string<DISABLED|ENABLED> │ │ │ ├ ResumeTimeoutInSeconds: integer │ │ │ ├ Suspend: string<DISABLED|ENABLED> │ │ │ ├ SuspendTimeoutInSeconds: integer │ │ │ ├ Terminate: string<DISABLED|ENABLED> │ │ │ └ TerminateTimeoutInSeconds: integer │ │ ├ type MicrovmImageHooks │ │ │ ├ name: MicrovmImageHooks │ │ │ └ properties │ │ │ ├ Ready: string<DISABLED|ENABLED> │ │ │ ├ ReadyTimeoutInSeconds: integer │ │ │ ├ Validate: string<DISABLED|ENABLED> │ │ │ └ ValidateTimeoutInSeconds: integer │ │ └ type Resources │ │ ├ name: Resources │ │ └ properties │ │ └ MinimumMemoryInMiB: integer (required) │ └[+] resource AWS::Lambda::NetworkConnector │ ├ name: NetworkConnector │ │ cloudFormationType: AWS::Lambda::NetworkConnector │ │ documentation: Resource Type definition for AWS::Lambda::NetworkConnector │ │ tagInformation: {"tagPropertyName":"Tags","variant":"standard"} │ │ arnTemplate: arn:${Partition}:lambda:${Region}:${Account}:network-connector:${NetworkConnectorId} │ │ primaryIdentifier: ["Arn"] │ ├ properties │ │ ├ Name: string (immutable) │ │ ├ Configuration: Config (required) │ │ ├ OperatorRole: string │ │ └ Tags: Array<tag> │ ├ attributes │ │ ├ Arn: string │ │ └ State: string<PENDING|ACTIVE|INACTIVE|FAILED|DELETING|DELETE_FAILED> │ └ types │ ├ type Config │ │ ├ documentation: The network configuration for the connector. Specify a VpcEgressConfiguration to enable outbound traffic routing through your VPC. │ │ │ name: Config │ │ └ properties │ │ └ VpcEgressConfiguration: VpcEgressConfiguration (required) │ └ type VpcEgressConfiguration │ ├ documentation: The VPC egress configuration for the network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC. │ │ name: VpcEgressConfiguration │ └ properties │ ├ SubnetIds: Array<string> (required) │ ├ SecurityGroupIds: Array<string> │ ├ NetworkProtocol: string<IPv4|DualStack> │ └ AssociatedComputeResourceTypes: Array<string<MicroVm>> (required) ├[~] service aws-medialive │ └ resources │ └[~] resource AWS::MediaLive::Channel │ └ types │ ├[+] type AudioFeedInput │ │ ├ name: AudioFeedInput │ │ └ properties │ │ ├ AudioSelectorName: string │ │ └ FeedInput: string │ ├[~] type AudioNormalizationSettings │ │ └ properties │ │ ├[+] PeakCalculation: string │ │ └[+] PeakLimiterThreshold: number │ ├[+] type AudioPid │ │ ├ name: AudioPid │ │ └ properties │ │ ├ DolbyEDecode: AudioDolbyEDecode │ │ ├ PremixSettings: AudioPreMixerSettings │ │ └ Pid: integer │ ├[~] type AudioPidSelection │ │ └ properties │ │ └[+] Pids: Array<AudioPid> │ ├[+] type AudioPreMixerSettings │ │ ├ name: AudioPreMixerSettings │ │ └ properties │ │ ├ AudioNormalizationSettings: AudioNormalizationSettings │ │ ├ RemixSettings: RemixSettings │ │ ├ GainDb: number │ │ └ Channels: integer │ ├[~] type AudioTrack │ │ └ properties │ │ └[+] PremixSettings: AudioPreMixerSettings │ ├[~] type CaptionSelectorSettings │ │ └ properties │ │ └[+] SmartSubtitleSourceSettings: SmartSubtitleSourceSettings │ ├[~] type InferenceSettings │ │ └ properties │ │ └[+] AudioFeedInputs: Array<AudioFeedInput> │ └[+] type SmartSubtitleSourceSettings │ ├ name: SmartSubtitleSourceSettings │ └ properties │ ├ InferenceFeedOutput: string │ └ CaptionSynchronizationMode: string ├[~] service aws-mediatailor │ └ resources │ └[~] resource AWS::MediaTailor::SourceLocation │ └ - arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${SourceLocationName} │ + arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${ResourceId} ├[~] service aws-msk │ └ resources │ └[~] resource AWS::MSK::Replicator │ └ types │ ├[~] type KafkaClusterClientAuthentication │ │ └ properties │ │ ├[+] MTLS: KafkaClusterMtlsAuthentication │ │ └ SaslScram: - KafkaClusterSaslScramAuthentication (required) │ │ + KafkaClusterSaslScramAuthentication │ └[+] type KafkaClusterMtlsAuthentication │ ├ documentation: Details for mTLS client authentication. │ │ name: KafkaClusterMtlsAuthentication │ └ properties │ └ SecretArn: string (required) ├[~] service aws-neptune │ └ resources │ ├[~] resource AWS::Neptune::DBCluster │ │ └ - arnTemplate: arn:aws:rds:${Region}:${Account}:cluster:${DBClusterId} │ │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName} │ └[~] resource AWS::Neptune::DBClusterParameterGroup │ └ - arnTemplate: arn:aws:rds:${Region}:${Account}:cluster-pg:${ClusterPGName} │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName} ├[~] service aws-networkfirewall │ └ resources │ └[~] resource AWS::NetworkFirewall::RuleGroup │ └ - arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateless-rulegroup/${Name} │ + arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateful-rulegroup/${Name} ├[~] service aws-networkmanager │ └ resources │ ├[~] resource AWS::NetworkManager::ConnectPeer │ │ └ - arnTemplate: arn:${Partition}:networkmanager::${Account}:connect-peer/${ConnectPeerId} │ │ + arnTemplate: arn:${Partition}:networkmanager::${Account}:connect-peer/${ResourceId} │ └[~] resource AWS::NetworkManager::GlobalNetwork │ └ - arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${ResourceId} │ + arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${GlobalNetworkId} ├[~] service aws-pcs │ └ resources │ └[~] resource AWS::PCS::Cluster │ └ properties │ └ Scheduler: - Scheduler (required, immutable) │ + Scheduler (required) ├[~] service aws-pinpoint │ └ resources │ ├[~] resource AWS::Pinpoint::EmailTemplate │ │ └ - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH │ │ + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE │ ├[~] resource AWS::Pinpoint::InAppTemplate │ │ └ - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH │ │ + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE │ └[~] resource AWS::Pinpoint::PushTemplate │ └ - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH │ + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/VOICE ├[~] service aws-quicksight │ └ resources │ └[~] resource AWS::QuickSight::Analysis │ └ - arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:analysis/${AnalysisId} │ + arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:analysis/${ResourceId} ├[~] service aws-ram │ └ resources │ └[~] resource AWS::RAM::ResourceShare │ ├ properties │ │ └[+] ResourceShareConfiguration: ResourceShareConfiguration │ └ types │ └[+] type ResourceShareConfiguration │ ├ documentation: The configuration for a resource share. │ │ name: ResourceShareConfiguration │ └ properties │ ├ ExclusiveAccountAccess: boolean │ └ RetainSharingOnAccountLeaveOrganization: boolean (immutable) ├[~] service aws-rds │ └ resources │ ├[~] resource AWS::RDS::DBCluster │ │ └ - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${ClusterName} │ │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName} │ ├[~] resource AWS::RDS::DBInstance │ │ └ - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:db:${DBInstanceId} │ │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName} │ └[~] resource AWS::RDS::DBShardGroup │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:shard-group:${DbShardGroupResourceId} ├[~] service aws-s3 │ └ resources │ └[~] resource AWS::S3::Bucket │ ├ attributes │ │ ├[+] MetadataConfiguration.AnnotationTableConfiguration.TableArn: string │ │ └[+] MetadataConfiguration.AnnotationTableConfiguration.TableName: string │ └ types │ ├[+] type AnnotationTableConfiguration │ │ ├ name: AnnotationTableConfiguration │ │ └ properties │ │ ├ TableName: string │ │ ├ TableArn: string │ │ ├ ConfigurationState: string<ENABLED|DISABLED> (required) │ │ ├ EncryptionConfiguration: MetadataTableEncryptionConfiguration │ │ └ Role: string │ └[~] type MetadataConfiguration │ └ properties │ └[+] AnnotationTableConfiguration: AnnotationTableConfiguration ├[~] service aws-sagemaker │ └ resources │ └[~] resource AWS::SageMaker::Cluster │ ├ properties │ │ └[+] RestrictedInstanceGroupsConfig: RestrictedInstanceGroupsConfig │ └ types │ ├[~] type ClusterRestrictedInstanceGroup │ │ └ properties │ │ └ EnvironmentConfig: - EnvironmentConfig (required) │ │ + EnvironmentConfig │ ├[+] type RestrictedInstanceGroupsConfig │ │ ├ documentation: The cluster-level configuration for restricted instance groups, including shared environment settings for inter-RIG communication and FSx Lustre sharing. │ │ │ name: RestrictedInstanceGroupsConfig │ │ └ properties │ │ └ SharedEnvironmentConfig: SharedEnvironmentConfig (required) │ └[+] type SharedEnvironmentConfig │ ├ documentation: The shared environment configuration for restricted instance groups that use cluster-level shared FSx Lustre storage. │ │ name: SharedEnvironmentConfig │ └ properties │ ├ FSxLustreDeletionPolicy: string<Keep|DeleteIfNotUsed> (required) │ └ FSxLustreConfig: FSxLustreConfig └[~] service aws-wafv2 └ resources ├[~] resource AWS::WAFv2::LoggingConfiguration │ └ types │ └[~] type ActionCondition │ └ properties │ └ Action: - string<ALLOW|BLOCK|COUNT|CAPTCHA|CHALLENGE|EXCLUDED_AS_COUNT> (required) │ + string<ALLOW|BLOCK|COUNT|CAPTCHA|CHALLENGE|MONETIZE|EXCLUDED_AS_COUNT> (required) ├[~] resource AWS::WAFv2::RuleGroup │ ├ properties │ │ └[+] MonetizationConfig: MonetizationConfig │ └ types │ ├[+] type CryptoConfig │ │ ├ documentation: Configures cryptocurrency payment settings. │ │ │ name: CryptoConfig │ │ └ properties │ │ └ PaymentNetworks: Array<PaymentNetwork> (required) │ ├[+] type MonetizationConfig │ │ ├ documentation: Configures monetization for the web ACL or rule group. │ │ │ name: MonetizationConfig │ │ └ properties │ │ ├ CryptoConfig: CryptoConfig │ │ └ CurrencyMode: string<REAL|TEST> │ ├[+] type MonetizeAction │ │ ├ documentation: Monetize action for rules. │ │ │ name: MonetizeAction │ │ └ properties │ │ └ PriceMultiplier: string │ ├[+] type PaymentNetwork │ │ ├ documentation: Configuration for a single payment network. │ │ │ name: PaymentNetwork │ │ └ properties │ │ ├ Chain: string<BASE|SOLANA|BASE_SEPOLIA|SOLANA_DEVNET> (required) │ │ ├ WalletAddress: string (required) │ │ └ Prices: Array<Price> (required) │ ├[+] type Price │ │ ├ documentation: A price configuration. │ │ │ name: Price │ │ └ properties │ │ ├ Amount: string (required) │ │ └ Currency: string<USDC> (required) │ └[~] type RuleAction │ └ properties │ └[+] Monetize: MonetizeAction └[~] resource AWS::WAFv2::WebACL ├ properties │ └[+] MonetizationConfig: MonetizationConfig └ types ├[+] type CryptoConfig │ ├ documentation: Configures cryptocurrency payment settings. │ │ name: CryptoConfig │ └ properties │ └ PaymentNetworks: Array<PaymentNetwork> (required) ├[+] type MonetizationConfig │ ├ documentation: Configures monetization for the web ACL or rule group. │ │ name: MonetizationConfig │ └ properties │ ├ CryptoConfig: CryptoConfig │ └ CurrencyMode: string<REAL|TEST> ├[+] type MonetizeAction │ ├ documentation: Monetize action for rules. │ │ name: MonetizeAction │ └ properties │ └ PriceMultiplier: string ├[+] type PaymentNetwork │ ├ documentation: Configuration for a single payment network. │ │ name: PaymentNetwork │ └ properties │ ├ Chain: string<BASE|SOLANA|BASE_SEPOLIA|SOLANA_DEVNET> (required) │ ├ WalletAddress: string (required) │ └ Prices: Array<Price> (required) ├[+] type Price │ ├ documentation: A price configuration. │ │ name: Price │ └ properties │ ├ Amount: string (required) │ └ Currency: string<USDC> (required) └[~] type RuleAction └ properties └[+] Monetize: MonetizeAction ``` ## CHANGES TO L1 RESOURCES L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed: - **aws-cloudwatch**: `AWS::CloudWatch::LogAlarm`: `QueryLanguage` property has been removed from the `ScheduledQueryConfiguration` type. - **aws-elasticloadbalancing**: `AWS::ElasticLoadBalancing::LoadBalancer`: `Id` attribute has been removed and the primary identifier is now `LoadBalancerName`.

…38235) Closes #38223 `table` and its sub-dependencies (`ajv` -> `fast-uri`) keep triggering CVEs, and have in the past too. `table` isn't used anywhere in the source anymore (its only usage was removed in #38166), so removing it altogether drops the whole bundled subtree and resolves the CVE scan. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions · 2026-07-02T10:17:14Z

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

Add BREAKING CHANGES entries for the L1 CloudFormation resource update (aws-cloudwatch LogAlarm QueryLanguage removal, aws-elasticloadbalancing LoadBalancer Id attribute removal). Placed under the stable breaking changes header, not experimental, since L1s are not experimental.

github-actions · 2026-07-02T10:33:08Z

🤖 Agent Docs Sync Reminder

This PR modifies human-facing documentation that has corresponding agent-facing docs.
Please check whether the following agent-facing files need matching updates:

AGENTS.md
docs/AGENTS_CONSTRUCT_DESIGN.md
docs/AGENTS_CONSTRUCT_IMPLEMENTATION.md

If you consider no agent-facing changes are needed, leave a comment explaining why
and a maintainer will remove the agent-docs-review-needed label.

mergify · 2026-07-02T11:25:59Z

Thank you for contributing! Your pull request will be automatically updated and merged without squashing (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-07-02T11:26:04Z

Merge Queue Status

✅ Entered queue — 2026-07-02 11:25 UTC · Rule: default-merge · triggered by rule automatic merge (no-squash)
✅ Checks skipped · PR is already up-to-date
✅ Merged — 2026-07-02 11:26 UTC · at 65fdd58102dee571ca5f8d1dd6a82f04e2669e68 · merge

This pull request spent 16 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

#approved-reviews-by >= 1 [🛡 GitHub branch protection]
- chore(release): 2.261.0 #38237
any of [🛡 GitHub branch protection]:
- check-success = build
- check-neutral = build
- check-skipped = build
any of [🛡 GitHub branch protection]:
- check-success = validate-pr
- check-neutral = validate-pr
- check-skipped = validate-pr

github-actions · 2026-07-02T11:26:25Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

otaviomacedo and others added 24 commits June 16, 2026 13:42

Merge branch 'main' into merge-back/2.260.0

007e268

chore(merge-back): 2.260.0 (#38159)

5f2a1fe

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.260.0/CHANGELOG.md)

chore: update Contributors File (#38224)

96508bd

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action

chore: refactor some integ tests to not use deprecated APIs (#38146)

ea153ff

---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

chore(release): 2.261.0

ee07ddf

aws-cdk-automation requested a review from a team as a code owner July 2, 2026 10:15

aws-cdk-automation added auto-approve pr/no-squash This PR should be merged instead of squash-merging it labels Jul 2, 2026

aws-cdk-automation temporarily deployed to automation July 2, 2026 10:15 — with GitHub Actions Inactive

github-actions Bot added the p2 label Jul 2, 2026

aws-cdk-automation requested a review from a team July 2, 2026 10:15

github-actions Bot approved these changes Jul 2, 2026

View reviewed changes

aws-cdk-automation temporarily deployed to automation July 2, 2026 10:15 — with GitHub Actions Inactive

github-actions Bot added the agent-docs-review-needed label Jul 2, 2026

aws-cdk-automation temporarily deployed to automation July 2, 2026 10:16 — with GitHub Actions Inactive

abidhasan-aws added the pr/do-not-merge This PR should not be merged at this time. label Jul 2, 2026

abidhasan-aws temporarily deployed to automation July 2, 2026 10:18 — with GitHub Actions Inactive

aws-cdk-automation and others added 2 commits July 2, 2026 10:18

chore: update analytics metadata blueprints

1be62ae

abidhasan-aws temporarily deployed to automation July 2, 2026 10:32 — with GitHub Actions Inactive

abidhasan-aws temporarily deployed to automation July 2, 2026 10:33 — with GitHub Actions Inactive

abidhasan-aws removed the agent-docs-review-needed label Jul 2, 2026

abidhasan-aws temporarily deployed to automation July 2, 2026 11:18 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jul 2, 2026

aws-cdk-automation temporarily deployed to automation July 2, 2026 11:19 — with GitHub Actions Inactive

aws-cdk-automation temporarily deployed to automation July 2, 2026 11:20 — with GitHub Actions Inactive

abidhasan-aws removed the pr/do-not-merge This PR should not be merged at this time. label Jul 2, 2026

abidhasan-aws temporarily deployed to automation July 2, 2026 11:23 — with GitHub Actions Inactive

mergify Bot merged commit f3c62b6 into v2-release Jul 2, 2026
37 of 38 checks passed

mergify Bot deleted the bump/2.261.0 branch July 2, 2026 11:26

github-actions Bot locked as resolved and limited conversation to collaborators Jul 2, 2026

Navigation Menu

Uh oh!

chore(release): 2.261.0 - #38237

chore(release): 2.261.0#38237
mergify[bot] merged 26 commits into
v2-releasefrom
bump/2.261.0

aws-cdk-automation commented Jul 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

mergify Bot commented Jul 2, 2026

Uh oh!

mergify Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

Uh oh!

Conversation

aws-cdk-automation commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

🤖 Agent Docs Sync Reminder

Uh oh!

mergify Bot commented Jul 2, 2026

Uh oh!

mergify Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

aws-cdk-automation commented Jul 2, 2026 •

edited

Loading

mergify Bot commented Jul 2, 2026 •

edited

Loading